diff --git a/js/app.js b/js/app.js
index f58f865..842b2ea 100644
--- a/js/app.js
+++ b/js/app.js
@@ -7197,6 +7197,12 @@ async function init() {
     }, true);
     document.addEventListener('click', e => {
         if (!$('#slideover').classList.contains('is-open')) return;
+        // Only a real click can mean "the user clicked away". A programmatic
+        // .click() — the hidden file input behind Import, the <a download>
+        // behind an attachment save — is appended to <body>, so it bubbles up
+        // here looking exactly like an outside click and popped the discard
+        // prompt on top of the native file dialog. isTrusted tells them apart.
+        if (!e.isTrusted) return;
         if (_slideoverMouseDownInside) { _slideoverMouseDownInside = false; return; }
         if (e.target.closest('.slideover')) return;
         if (e.target.closest('.entry-card')) return;